topic Re: search fails in xml file in Splunk Search

search fails in xml file

DTERM — Fri, 21 Sep 2012 19:44:50 GMT

The following search works fine in the Splunk search:

index=mydata | rex "\s+IP\s+(?\d+.\d+.\d+.\d+).(?\S+)\s+>\s+(?\d+.\d+.\d+.\d+).(?[a-z0-9]+):\s+" | top src_ip

When I take that same search and place it in an xml file like:

  <searchTemplate>

index=dns | rex "\s+IP\s+(?\d+.\d+.\d+.\d+).(?\S+)\s+>\s+(?\d+.\d+.\d+.\d+).(?[a-z0-9]+):\s+" | top src_ip

It fails. (That search in the XML starts and ends with the searchTemplate tags although I don't see those in this post, though they are there.) I get the following error when trying to start Splunk:

Checking configuration... Error while parsing '/opt/splunk/etc/apps/myApp/default/data/ui/views/source.xml':

mismatched tag: line 6, column 4

I don't see the mismatched tag. What is the problem with the XML?

Thanks.

Re: search fails in xml file

bmacias84 — Fri, 21 Sep 2012 20:15:05 GMT

The problem with your search is the ">" and "<". The angel brackets are treated as part of XML tags. Replace those with the HTML entities & lt; and & gt; . Hope that fixes your problem.

Re: search fails in xml file

DTERM — Mon, 28 Sep 2020 12:29:55 GMT

Based on this response, I've created the following search:

index=data | rex "\s+IP\s+(?<src_ip> \d+.\d+.\d+.\d+).(?<src_port>\S+)\s+>\s+(?<dest_ip>\d+.\d+.\d+.\d+).(?<dest_port>[a-z0-9]+):\s+" | top src_ip

This still fails in the XML file. Is there anything within Splunk that helps resolve such regular expressions? Why does this not work? What is incorrect?